CICI: CE: Improving the Security of a Science DMZ

大科学一词是指涉及海量数据的科学。通过普通网络传输这些数据非常慢，部分原因是数据量超过了普通网络的设计处理能力，部分原因是网络安全机制执行的检查。科学DMZ(非军事区)是一个专为快速移动海量数据而设计的特殊网络。这样做的需要会影响安全；在进入时进行检查，并且只对连接的第一部分进行检查。如果连接可疑，则会被阻止；否则，会被允许通过。该项目通过在连接的整个生命周期中对连接中的数据进行采样来扩展检查。然后，如果在样本中检测到可疑情况，就可以采取适当的行动。该项目的第二个目标是确定在检测到恶意流时，哪些程序或技术操作最有效。最终目标是确定如何加快安全分析，以便对吞吐量的影响最小且可接受。总体目标是在不牺牲速度的情况下确保科学DMZ网络的安全。更具体地说，在科学DMZ上，移动了大量数据，这使得保护变得非常困难，因此只有在连接启动时才对数据进行采样，并在不阻止连接的情况下进行分析。如果分析显示它是恶意的，则会向路由器添加过滤规则，以丢弃该连接中的数据包。此项目不仅在开始时进行采样，而且在连接处于活动状态时的不同时间进行采样。如果在连接过程中启动了恶意操作，则可以检测到它。当发现可疑流量时该怎么做不太清楚；该项目将检查技术和程序方法，例如将流量减慢到可以进行彻底分析的程度，然后如果确实是恶意的，向首席信息安全官S办公室提供信息，使他们能够采取行动。如果流不是恶意的(即，通过更详细的分析确认的假阳性)，则速率降低将停止。一个关键问题是如何减少抽样分析所需的时间。这个项目的一部分是研究如何使用GPU来加快入侵检测系统的速度，以便更快地进行分析。

The term "big science" refers to science that involves massive amounts of data. Moving this data through ordinary networks is very slow, in part because the amount of data is more than ordinary networks are designed to handle, and in part because of the checking that network security mechanisms perform. The "science DMZ" (DeMilitarized Zone) is a special network designed to move massive amounts of data very quickly. The need to do so results in compromises affecting security; checking is done on entry, and only for the first part of the connection. If the connection is suspicious, it is blocked; otherwise, it is allowed through. This project extends the checking by sampling the data in the connection throughout the lifetime of the connection. Then, if something suspicious is detected in the samples, appropriate action can be taken. A second goal of this project is to determine what procedural or technical actions are most effective when malicious flows are detected. The final goal is to determine how to speed up the security analysis so the impact on the throughput is both minimal and acceptable. The overall goal is to secure the science DMZ network without sacrificing speed.More specifically, on a science DMZ, large amounts of data are moved, making it very difficult to secure, so data is sampled only when a connection starts and is analyzed without blocking the connection. If the analysis shows it is malicious, a filter rule is added to the router to drop packets in that connection. This project samples not just at the beginning, but at various times while the connection is active. If something malicious starts during the connection, it can be detected. What to do when suspicious flows are identified is less clear; the project will examine both technical and procedural methods, for example slowing down the flow to where it can be analyzed thoroughly, and then if indeed malicious, provide information to the Chief Information Security Officer?s (CISO) office to enable them to take action. If the flow is not malicious (i.e., a false positive, confirmed by the more detailed analysis), the rate reduction will cease. A key question is how to reduce the time needed for the sampling analysis. Part of this project is to examine how to speed up intrusion detection systems by using GPUs in order to do a quicker analysis.